Managing Privacy Risk & Compliance in Financial Services. Brett Hamilton Advisory Solutions Consultant ServiceNow
|
|
- Oswin O’Brien’
- 6 years ago
- Views:
Transcription
1 Managing Privacy Risk & Compliance in Financial Services Brett Hamilton Advisory Solutions Consultant ServiceNow 1
2 Speaker Introduction INSERT PHOTO Name: Brett Hamilton Title: Advisory Solutions Consultant Function: Financial Services Industry Company: ServiceNow Brett has been a Solutions Consultant with ServiceNow for the last 2.5 years, most recently focusing on the Financial Services Sector; previous to that he has been working in the IT industry for various vendors focusing on Automation and Governance systems. 2
3 Regulations Driving IT Spend The regulations that matter the most What regulations are driving the funding of your organisation IT security? EU General Data Protection Regulation Internal laws by country PCI DDS Sarbanes-Oxley US state laws for data breach GLBA HIPAA (including HITECH) NERC CIP FISMA FACTA FCRA Federal Privacy Act CANSPAM 3% 2% 2% 2% 2% 1% 1% 6% 17% 26% 47% 51% 50%
4 Australian Mandatory Breach Notification What Does This Mean? Who Does This Affect? When Does This Happen? Why Is This Relevant To You? Organisations and agencies will be required to notify when a breach has occurred. Mid-sized to large organisations in addition to government agencies. It is expected to go into full affect by 1 March 2018 Impact brand or agency reputation that could lead to financial loss or government trust 4
5 GDPR By The Numbers % 250m th of May, 2018 the regulation will be enforced Potential fines as a percentage of global turnover Cost of 4% fine for a typical FTSE 100 company Countries potentially in scope of the regulation 28, Organisations potentially in scope New requirements in the GDPR Core individual rights afforded under the GDPR Hours given to report a data breach 5
6 GDPR What Is It? The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a Regulation by which the European Commission intends to strengthen and unify data protection for European Union (EU) citizens, regardless of where the company is based Major goals of the General Data Protection Regulation (GDPR) (2016/679/EU) are: Protect personal data of EU citizens Establish rules for free movement of personal data in the EU Extend to all organizations globally that engage EU citizens Requirements catalog is published in 28 languages and includes 99 articles and 1021 citations EU GDPR Official Website 6
7 Challenge: Current State of GRC for Many Unknown or High Costs Risks and Vulnerabilities Complexity in silos Losses Due to Non-compliance (investigations, fines, etc.) Lack of Confidence in People, Process and Technology 7
8 GDPR Amps Up the Challenges Must have consent to use an EU citizen s personal data Must protect their privacy Must be able to send the data to other organizations if user requests it Must be able to delete the personal data in all locations if the user requests it Personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a photo, an address, bank details, posts on social networking websites, medical information, or a computer s IP address. 8
9 GDPR Amps Up the Challenges Data Protection Impact Assessments (Article 35) have to be conducted when specific risks occur to the rights and freedoms of data subjects. Risk assessment and mitigation is required and a prior approval of the DPA for high risks. Enterprises that process personal data for 5,000 EU citizens or more must hire a Data Protection Officer. 9
10 Specific GDPR Challenges 72hr Expanded definition of personal data & specific consent to use required Transport or delete data when requested Data Protection Impact Assessments (DPIA) required regularly Breach Notification within 72 hours 10
11 ServiceNow Solution: Get to the Future State of GRC Now You Don t Want to Pay the ENORMOUS Fines Associated with GDPR Reduce the Pain of Compliance and Audit Realistic Implementation Timeframes Measure Success Guidance is Available to Determine the Path Forward Return to Core Business Utilize a Common Integrated Platform 11
12 Customer Benefits from ServiceNow GRC Now there is much more traceability and audit teams can instantly pull reports from one system. Compliance management is improved with automation and real-time visibility of key controls. The entire compliance exception lifecycle is automated and traceable so the team can provide comprehensive, reliable evidence to regulators for all exceptions. Compliance is streamlined and the team reclaimed over 75 hours a week by eliminating manual efforts. 12
13 ServiceNow GRC and GDPR Supporting Your Compliance Journey With Our Scalable Solution 13
14 Framework for GRC & Security Operations Internal Goals and Objectives Inherent Exposure, Vulnerability & Threats External Legislation and Regulations Governance, Oversight, & Policy Management System of Internal Controls Risk Management ServiceNow can map identified GDPR requirements directly into the application with the underlying citation and controls needed for compliance checks and continuous monitoring. All GDPR requirements with description and guidance can be imported in ServiceNow with available UCF integration. Security Operations A license to import the GDPR content from Common Controls Hub is required. GDPR Authority Document & Citations Compliance Management Compliance Management Compliance Management Policy Regulations Third Party Security Incident Response Threat Intelligence Vulnerability Response Audit Management, Observations, and Remediation 14
15 Step 1: Align Organisational Policies with GDPR Data Protection Policy Security Policy Policy Code of Conduct ServiceNow Capabilities: ServiceNow offers a full Policy Life Cycle Management. Drafting a policy according to requirements through Review, Approval, Publishing and Retirement stages are available out-of-the-box. A policy can include the GDPR requirements listed within it for alignment. Knowledge Base information can be automatically created while publishing the relevant policy. Knowledge Base 15
16 Step 2: Schedule Data Protection Impact Assessments ServiceNow Capabilities: Data Protection Assessments can be aligned with Data Protection Policy and underlying requirements in ServiceNow. All assessments requirements can be built with the Assessments Designer or enhanced with existing Data Protection Assessments. The assessments can be scheduled to run at regular intervals. Attestations 16
17 Step 3: Gain Visibility into Compliance Status ServiceNow Capabilities: Roles based access provides stakeholders the information they need to make decisions and there are specific dashboards for contributors, approvals, audit, and control testing. Control Compliance The compliance status can display in a dashboard to easily view compliance levels and take any needed remediation actions. Assessment outcomes are also reflected in the Compliance Dashboard. Controls status is automatically updated. For any non-compliant outcomes, an issue will be automatically created and assigned to the responsible party to take actions on requirement gaps. Issues & Remediation Compliance Dashboard 17
18 Step 4: Define Risk Framework ServiceNow Capabilities: ServiceNow provides a full Risk Management Lifecycle process including robust scoring, risk indicators, financial impact based reporting, statistical reporting, etc. Regular risk assessments can be implemented & assigned automatically. Risk identification & compliance stats can be made transparent. Breach notifications with associated risks can be sent automatically or manually to the designated Supervisory Authority. Data processing on Information layer with PII can be implemented. Pseudonymisation and encryption functionalities support GDPR compliance. Risk Dashboard GDPR Risk Assessment Risk Management 18
19 Step 5: Measure Risk on Critical Systems ServiceNow Capabilities: CIA assurance of systems & applications. Unauthorized disclosure of business records stored or processed by the business service results in reputation damage, legal penalties, and/or fines. Failure to maintaining the consistency, accuracy, and trustworthiness of data stored or processed by the business service results in reputation damage, legal penalties, and/or fines. CIA Risks for GDPR Failure to maintain timely and reliable access to and use of information processed by the business service results in a loss of revenues, productivity, and/or customer confidence. 19
20 Step 6: Manage Audit Engagements ServiceNow Capabilities: GDPR Dashboards monitor the global level of compliance to GDPR, as well as by specific entities, systems, units, etc. Design and run regular GDPR Audits targeting the enterprise and its PII sensitive systems. Generate remediation plans and track Data Protection corrective actions to conclusion. Same visibility, ease of management, and overall process is available for basically all regulations Issues & Remediation Audit Workbench 20
21 Step 7: Identify PII Assets ServiceNow Capabilities: Manage information assets and associate them to other CIs. Profile information assets to generate associated risks and controls. Manage risks, continuous control monitoring and data protection impact assessments on information assets as well as on business services or on IT CIs. Relating Risks, Control, & Audit Engagements to Information PII & PCI Information 21
22 Step 8: Design PII Breach Processes ServiceNow Capabilities: Leveraging ServiceNow CMDB to manage Information Assets and associate them to other CIs. Connecting PII Security Incidents to Information Assets to understand the Risks and Controls towards them. Managing PII Security Incidents to containment and root cause analysis. Escalating and reporting on PII Security Incidents to the wider Enterprise and to the DPO. Reporting PII Security Incidents to the Supervisory Authority Security Incident Workflow & Treatment PII Information SecOps & GRC 22
23 Step 9: Assess your 3 rd Parties GDPR Compliance ServiceNow Capabilities: Implementing Vendor Risk Management from ServiceNow to: - Manage the Vendors portfolio - Design a library of Assessments, based on questionnaires and evidence collection. - Schedule the Data Privacy Assessments to Vendors, based on Tiers / Risks. - Connect questionnaire questions to GRC controls, so that the Vendors response automatically sets the related control to Compliant / noncompliant. - Propose an external Vendor portal for Vendors to freely respond to the Privacy Assessments pushed to them. - Managed identified Issues / Actions to resolution to improve Vendors GDPR compliance. Privacy Questionnaire Vendor Portal Vendor Portfolio SecOps & GRC 23
24 Finally! DPO Processes & Dashboard Visibility ServiceNow Capabilities: Leveraging Performance analytics and the standard ServiceNow dashboarding / reporting engine: - Follow up the level of Compliance & Risks for various dimensions (Group, Units, Processes, Systems, CIs, Information (PII), Projects, etc - Manage the DPIAs and their results - Manage the GDPR Control Framework and follow the attestations, evidence, indicators of some critical controls. - Review the progress of remediation Issues & Tasks to completion. - Review the progress of PII breach Security Incident to completion. - Trend to understand progress towards full compliance and evaluate predictive analytics. - Report to the Supervisory Authority based on evidence. SecOps & GRC 24
25 Simplify Personal Data Record Compliance ServiceNow Capabilities: Use ServiceNow Customer Service Management to interact with EU Citizens. Manage requests for personal data updates, transfers, and deletions. Provide personal data access for EU Citizens through CSM portals. Provide GDPR related information, policies & procedures. Manage specific consents (opt-in, opt-out, etc.) Supply GDPR risk Information directly to EU citizens. 25
26 Simplify Personal Data Record Compliance The same GDPR requirements apply to more than customers and prospects. Easily manage personal data for employees, vendors, third parties, and other types of EU citizens. 26
27 What are customers saying about ServiceNow GRC Productivity Gains Integrated GRC gave us back over 9000 IT man hours annually. We ve reduced our audit data collection time by 93% Rapid ROI We were up and running with full functionality in just eight weeks allowing the quarterly audit activities to proceed without a hitch. Reliable, Real-time Insight When we provide results to executives, ServiceNow has done the work for us with accuracy and ease. ServiceNow GRC gives us realtime insight to metrics. Proactive Risk Management We are taking our controls framework from being manual and detective to being automatic and preventative and embedded within the processes we are implementing in ServiceNow Cost Avoidance We re able to avoid large fines ~$200MM per year, in addition to large audit, consulting, and project related fees ~400MM per year. Significant Cost Reduction Our annual audit costs were reduced by 80%. We re expecting to save on average ~$4MM per year per control automation. 27
28 Top Takeaways ServiceNow GRC is scalable to accommodate many new and existing regulations The GDPR can be managed through ServiceNow s GRC application The heavily regulated financial industry can use the combination of GRC and SecOps for GDPR and much more 28
Demystifying Governance, Risk, and Compliance (GRC) with 4 Simple Use Cases. Gen Fields Senior Solution Consultant, Federal Government ServiceNow
Demystifying Governance, Risk, and Compliance (GRC) with 4 Simple Use Cases Gen Fields Senior Solution Consultant, Federal Government ServiceNow 1 Agenda The Current State of Governance, Risk, and Compliance
More informationEU GDPR and . The complete text of the EU GDPR can be found at What is GDPR?
EU GDPR and Email The EU General Data Protection Regulation (GDPR) is the new legal framework governing the use of the personal data of European Union (EU) citizens across all EU markets. It replaces existing
More informationGDPR: An Opportunity to Transform Your Security Operations
GDPR: An Opportunity to Transform Your Security Operations McAfee SIEM solutions improve breach detection and response Is your security operations GDPR ready? General Data Protection Regulation (GDPR)
More informationEU General Data Protection Regulation (GDPR) Achieving compliance
EU General Data Protection Regulation (GDPR) Achieving compliance GDPR enhancing data protection and privacy The new EU General Data Protection Regulation (GDPR) will apply across all EU member states,
More informationCybersecurity Considerations for GDPR
Cybersecurity Considerations for GDPR What is the GDPR? The General Data Protection Regulation (GDPR) is a brand new legislation containing updated requirements for how personal data of European Union
More informationSOLUTION BRIEF HELPING BREACH RESPONSE FOR GDPR WITH RSA SECURITY ADDRESSING THE TICKING CLOCK OF GDPR COMPLIANCE
HELPING BREACH RESPONSE FOR GDPR WITH RSA SECURITY ADDRESSING THE TICKING CLOCK OF GDPR COMPLIANCE PREPARATION FOR GDPR IS ESSENTIAL The EU GDPR imposes interrelated obligations for organizations handling
More informationData Management and Security in the GDPR Era
Data Management and Security in the GDPR Era Franck Hourdin; Vice President, EMEA Security Russ Lowenthal; Director, Database Security Product Management Mike Turner; Chief Operating Officer, Capgemini
More informationGeneral Data Protection Regulation (GDPR)
BCD Travel s Response to the EU General Data Protection Regulation (GDPR) November 2017 Page 1 Response to the EU GDPR Copyright 2017 by BCD Travel N.V. All rights reserved. November 2017 Copyright 2017
More informationGeneral Data Protection Regulation (GDPR) The impact of doing business in Asia
SESSION ID: GPS-R09 General Data Protection Regulation (GDPR) The impact of doing business in Asia Ilias Chantzos Senior Director EMEA & APJ Government Affairs Symantec Corporation @ichantzos Typical Customer
More informationWHITE PAPER. The General Data Protection Regulation: What Title It Means and How SAS Data Management Can Help
WHITE PAPER The General Data Protection Regulation: What Title It Means and How SAS Data Management Can Help ii Contents Personal Data Defined... 1 Why the GDPR Is Such a Big Deal... 2 Are You Ready?...
More informationMITIGATE CYBER ATTACK RISK
SOLUTION BRIEF MITIGATE CYBER ATTACK RISK CONNECTING SECURITY, RISK MANAGEMENT & BUSINESS TEAMS TO MINIMIZE THE WIDESPREAD IMPACT OF A CYBER ATTACK DIGITAL TRANSFORMATION CREATES NEW RISKS As organizations
More informationAccelerate GDPR compliance with the Microsoft Cloud
Regional Forum on Cybersecurity in the Era of Emerging Technologies & the Second Meeting of the Successful Administrative Practices -2017 Cairo, Egypt 28-29 November 2017 Accelerate GDPR compliance with
More informationRisk: Security s New Compliance. Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23
Risk: Security s New Compliance Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23 Agenda Market Dynamics Organizational Challenges Risk: Security s New Compliance
More informationNEW DATA REGULATIONS: IS YOUR BUSINESS COMPLIANT?
NEW DATA REGULATIONS: IS YOUR BUSINESS COMPLIANT? What the new data regulations mean for your business, and how Brennan IT and Microsoft 365 can help. THE REGULATIONS: WHAT YOU NEED TO KNOW Australia:
More informationGDPR: A QUICK OVERVIEW
GDPR: A QUICK OVERVIEW 2018 Get ready now. 29 June 2017 Presenters Charles Barley Director, Risk Advisory Services Charles Barley, Jr. is responsible for the delivery of governance, risk and compliance
More informationDo you handle EU residents personal data? The GDPR update is coming May 25, Are you ready?
European Union (EU) General Data Protection Regulation (GDPR) Do you handle EU residents personal data? The GDPR update is coming May 25, 2018. Are you ready? What do you need to do? Governance and Accountability
More informationThe Role of the Data Protection Officer
The Role of the Data Protection Officer Adrian Ross LLB (Hons), MBA GRC Consultant IT Governance Ltd 28 July 2016 www.itgovernance.co.uk Introduction Adrian Ross GRC consultant Infrastructure services
More informationGetting ready for GDPR. Philipp Hobler EMEA Field CTO Global Technology Office Dell EMC Data Protection Solutions
Getting ready for GDPR Philipp Hobler EMEA Field CTO Global Technology Office Dell EMC Data Protection Solutions GDPR Background Single EU-wide Regulation Harmonizes Global User Data Protection across
More informationGeneral Data Protection Regulation (GDPR)
General Data Protection Regulation (GDPR) Michael Eva, London Grid for Learning What is GDPR? General Data Protection Regulation (GDPR) protects the personal data of EU citizens regardless of where the
More informationGDPR How to Comply in an HPE NonStop Environment. Steve Tcherchian GTUG Mai 2018
GDPR How to Comply in an HPE NonStop Environment Steve Tcherchian GTUG Mai 2018 Agenda About XYPRO What is GDPR Data Definitions Addressing GDPR Compliance on the HPE NonStop Slide 2 About XYPRO Inc. Magazine
More informationINTELLIGENCE DRIVEN GRC FOR SECURITY
INTELLIGENCE DRIVEN GRC FOR SECURITY OVERVIEW Organizations today strive to keep their business and technology infrastructure organized, controllable, and understandable, not only to have the ability to
More informationPlan a Pragmatic Approach to the new EU Data Privacy Regulation
AmChamDenmark event: EU Compliant & Cyber Resistant Plan a Pragmatic Approach to the new EU Data Privacy Regulation Janus Friis Bindslev, Partner Cyber Risk Services, Deloitte 4 February 2016 Agenda General
More informationlocuz.com SOC Services
locuz.com SOC Services 1 Locuz IT Security Lifecycle services combine people, processes and technologies to provide secure access to business applications, over any network and from any device. Our security
More informationIBM Security technology and services for GDPR programs GIULIA CALIARI SECURITY ARCHITECT
IBM Security technology and services for GDPR programs GIULIA CALIARI SECURITY ARCHITECT NOTICE Clients are responsible for ensuring their own compliance with various laws and regulations, including the
More informationBPS Suite and the OCEG Capability Model. Mapping the OCEG Capability Model to the BPS Suite s product capability.
BPS Suite and the OCEG Capability Model Mapping the OCEG Capability Model to the BPS Suite s product capability. BPS Contents Introduction... 2 GRC activities... 2 BPS and the Capability Model for GRC...
More informationEY s Data Privacy Services. January 2019
EY s Data Privacy Services January 2019 Introduction Data privacy encompasses the rights and obligations of individuals and organizations with respect to the collection, use, disclosure, and retention
More informationDemonstrating Compliance in the Financial Services Industry with Veriato
Demonstrating Compliance in the Financial Services Industry with Veriato Demonstrating Compliance in the Financial Services Industry With Veriato The biggest challenge in ensuring data security is people.
More informationSAS 70 Audit Concepts. and Benefits JAYACHANDRAN.B,CISA,CISM. August 2010
JAYACHANDRAN.B,CISA,CISM jb@esecurityaudit.com August 2010 SAS 70 Audit Concepts and Benefits Agenda Compliance requirements Overview Business Environment IT Governance and Compliance Management Vendor
More informationSix Weeks to Security Operations The AMP Story. Mike Byrne Cyber Security AMP
Six Weeks to Security Operations The AMP Story Mike Byrne Cyber Security AMP 1 Agenda Introductions The AMP Security Operations Story Lessons Learned 2 Speaker Introduction NAME: Mike Byrne TITLE: Consultant
More information11/14/2018. Istanbul Governance, risk, and compliance (GRC)
11/14/2018 Governance, risk, and compliance (GRC) Contents Contents... 4 Policy and Compliance Management...5 Activate Policy and Compliance Management... 6 Dependency modeling and mapping...13 Compliance...
More informationConducting a data flow mapping exercise under the GDPR. Presented by: Alan Calder, founder and executive chairman, IT Governance 4 October 2017
Conducting a data flow mapping exercise under the GDPR Presented by: Alan Calder, founder and executive chairman, IT Governance 4 October 2017 TM Introduction Alan Calder Founder of IT Governance The single
More informationGeneral Data Protection Regulation (GDPR) Key Facts & FAQ s
General Data Protection Regulation (GDPR) Key Facts & FAQ s GDPR comes into force on 25 May 2018 GDPR replaces the Data Protection Act 1998. The main principles are much the same as those in the current
More informationGoogle Cloud & the General Data Protection Regulation (GDPR)
Google Cloud & the General Data Protection Regulation (GDPR) INTRODUCTION General Data Protection Regulation (GDPR) On 25 May 2018, the most significant piece of European data protection legislation to
More informationThe GDPR and NIS Directive: Risk-based security measures and incident notification requirements
The GDPR and NIS Directive: Risk-based security measures and incident notification requirements Adrian Ross LLB (Hons), MBA GRC Consultant IT Governance Ltd 4 May 2017 Introduction Adrian Ross GRC consultant
More informationCybersecurity in Higher Ed
Cybersecurity in Higher Ed 1 Overview Universities are a treasure trove of information. With cyber threats constantly changing, there is a need to be vigilant in protecting information related to students,
More informationThe GDPR Are you ready?
The GDPR Are you ready? kpmg.ie The GDPR - Overview The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) will come into force from 25th May 2018, replacing the existing data protection
More informationBalancing Compliance and Operational Security Demands. Nov 2015 Steve Winterfeld
Balancing Compliance and Operational Security Demands Nov 2015 Steve Winterfeld What is more important? Compliance with laws / regulations Following industry best practices Developing a operational practice
More informationBest Practices & Lesson Learned from 100+ ITGRC Implementations
Best Practices & Lesson Learned from 100+ ITGRC Implementations Presenter: Vivek Shivananda CEO of Rsam Dec 3, 2010 ISACA -NY Chapter Copyright 2002 2010 Relational Security Corp. (dba Rsam) Agenda Overview
More informationDATA PROTECTION BY DESIGN
DATA PROTECTION BY DESIGN Preparing for Europe s New Security Regulations Summary In 2018, the European Union will begin to enforce the provisions of the General Data Protection Regulation (GDPR), a new
More informationSage Data Security Services Directory
Sage Data Security Services Directory PROTECTING INFORMATION ASSETS ENSURING REGULATORY COMPLIANCE FIGHTING CYBERCRIME Discover the Sage Difference Protecting your business from cyber attacks is a full-time
More informationEXAM PREPARATION GUIDE
EXAM PREPARATION GUIDE PECB Certified Data Protection Officer The objective of the PECB Certified Data Protection Officer examination is to ensure that the candidate has acquired the knowledge and skills
More informationGeneral Data Protection Regulation April 3, Sarah Ackerman, Managing Director Ross Patz, Consultant
General Data Protection Regulation April 3, 2018 Sarah Ackerman, Managing Director Ross Patz, Consultant Introductions Sarah Ackerman, CISSP, CISA Managing Director, Cincinnati Responsible for overall
More informationBHConsulting. Your trusted cybersecurity partner
Your trusted cybersecurity partner BH Consulting Securing your business BH Consulting is an award-winning, independent provider of cybersecurity consulting and information security advisory services. Recognised
More informationCipherCloud CASB+ Connector for ServiceNow
ServiceNow CASB+ Connector CipherCloud CASB+ Connector for ServiceNow The CipherCloud CASB+ Connector for ServiceNow enables the full suite of CipherCloud CASB+ capabilities, in addition to field-level
More informationSOLUTION BRIEF RSA ARCHER IT & SECURITY RISK MANAGEMENT
RSA ARCHER IT & SECURITY RISK MANAGEMENT INTRODUCTION Organizations battle growing security challenges by building layer upon layer of defenses: firewalls, antivirus, intrusion prevention systems, intrusion
More informationΟ ρόλος της τεχνολογίας στο ταξίδι της συμμόρφωσης με τον Γενικό Κανονισμό. Αντιγόνη Παπανικολάου & Νίκος Αναστόπουλος
Ο ρόλος της τεχνολογίας στο ταξίδι της συμμόρφωσης με τον Γενικό Κανονισμό Αντιγόνη Παπανικολάου & Νίκος Αναστόπουλος Providing clarity and consistency for the protection of personal data The General
More informationISO COMPLIANCE GUIDE. How Rapid7 Can Help You Achieve Compliance with ISO 27002
ISO 27002 COMPLIANCE GUIDE How Rapid7 Can Help You Achieve Compliance with ISO 27002 A CONTENTS Introduction 2 Detailed Controls Mapping 3 About Rapid7 8 rapid7.com ISO 27002 Compliance Guide 1 INTRODUCTION
More informationPrivacy Code of Conduct on mhealth apps the role of soft-law in enhancing trust ehealth Week 2016
Privacy Code of Conduct on mhealth apps the role of soft-law in enhancing trust ehealth Week 2016 Pēteris Zilgalvis, J.D., Head of Unit for Health and Well-Being, DG CONNECT Table of Contents 1. Context
More informationKeeping It Under Wraps: Personally Identifiable Information (PII)
Keeping It Under Wraps: Personally Identifiable Information (PII) Will Robinson Assistant Vice President Information Security Officer & Data Privacy Officer Federal Reserve Bank of Richmond March 14, 2018
More informationNext Generation Policy & Compliance
Next Generation Policy & Compliance Mason Karrer, CISSP, CISA GRC Strategist - Policy and Compliance, RSA Core Competencies C33 2013 Fall Conference Sail to Success CRISC CGEIT CISM CISA Introductions...
More informationGDPR: Get Prepared! A Checklist for Implementing a Security and Event Management Tool. Contact. Ashley House, Ashley Road London N17 9LZ
GDPR: Get Prepared! A Checklist for Implementing a Security and Event Management Tool Contact Ashley House, Ashley Road London N17 9LZ 0333 234 4288 info@networkiq.co.uk The General Data Privacy Regulation
More informationPROTECT YOUR DATA AND PREPARE FOR THE EUROPEAN GENERAL DATA PROTECTION REGULATION
PROTECT YOUR DATA AND PREPARE FOR THE EUROPEAN GENERAL DATA PROTECTION REGULATION INSIGHTS The EU s new data protection regulation, known as the GDPR (General Data Protection Regulation), can impact your
More informationEmbedding GDPR into the SDLC
Embedding GDPR into the SDLC Sebastien Deleersnyder Siebe De Roovere Toreon 2 Who is Who? Sebastien Deleersnyder Siebe De Roovere 5 years developer experience 15+ years information security experience
More informationGeneral Data Protection Regulation Frequently Asked Questions (FAQ) General Questions
General Data Protection Regulation Frequently Asked Questions (FAQ) This document addresses some of the frequently asked questions regarding the General Data Protection Regulation (GDPR), which goes into
More informationGain Control Over Your Cloud Use with Cisco Cloud Consumption Professional Services
Solution Overview Gain Control Over Your Cloud Use with Cisco Cloud Consumption Professional Services OPTIMIZE YOUR CLOUD SERVICES TO DRIVE BETTER BUSINESS OUTCOMES Reduce Cloud Business Risks and Costs
More informationMartijn Loderus. Merritt Maxim. Principal Analyst Forrester. Director & Global Practice Partner for Advisory Consulting Janrain
Merritt Maxim Principal Analyst Forrester Martijn Loderus Director & Global Practice Partner for Advisory Consulting Janrain Merritt and Martijn will share insights on Digital Transformation & Drivers
More informationIT MANAGEMENT AND THE GDPR: THE VMWARE PERSPECTIVE
TRANSFORM SECURITY DATA PROTECTION SOLUTION OVERVIEW IT MANAGEMENT AND THE GDPR: THE VMWARE PERSPECTIVE Introduction This Solution Overview is intended for IT personnel interested in the VMware perspective
More informationCybersecurity The Evolving Landscape
Cybersecurity The Evolving Landscape 1 Presenter Zach Shelton, CISA Principal DHG IT Advisory Zach.Shelton@DHG.com Raleigh, NC 14+ years of experience in IT Consulting 11+ years of experience with DHG
More informationGeneral Data Protection Regulation (GDPR) and the Implications for IT Service Management
General Data Protection Regulation (GDPR) and the Implications for IT Service Management August 2018 WHITE PAPER GDPR: What is it? The EU General Data Protection Regulation (GDPR) replaces the Data Protection
More informationGDPR COMPLIANCE REPORT
2018 GDPR COMPLIANCE REPORT INTRODUCTION Effective as of May 25, 2018, the European Union General Data Protection Regulation (GDPR) represents the most sweeping change in data privacy regulation in decades.
More informationEY s data privacy service offering. How to transform your data privacy capabilities for an EU General Data Protection Regulation (GDPR) world
EY s data privacy service offering How to transform your data privacy capabilities for an EU General Data Protection Regulation (GDPR) world In May 2018, the European Union s new General Data Protection
More informationGOVERNANCE, RISK MANAGEMENT AND COMPLIANCE TRENDS BY FCPAK ERIC KIMANI
GOVERNANCE, RISK MANAGEMENT AND COMPLIANCE TRENDS BY FCPAK ERIC KIMANI CONTENTS Overview Conceptual Definition Implementation of Strategic Risk Governance Success Factors Changing Internal Audit Roles
More information01.0 Policy Responsibilities and Oversight
Number 1.0 Policy Owner Information Security and Technology Policy Policy Responsibility & Oversight Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 1. Policy Responsibilities
More informationGDPR is here to stay. How prepared are you?
GDPR is here to stay. How prepared are you? KEY TENETS What & Why GDPR? A BRIEF General Data Protection Regulation (GDPR) is the European Union s new law for individuals data privacy & protection that
More informationAgenda GDPR Overview & Requirements IBM Secure Virtualization Solution Overview Summary / Call to Action Q & A 2
GRC3386BUS GDPR Readiness with IBM Cloud Secure Virtualization Raghu Yeluri, Intel Corporation Shantu Roy, IBM Bill Hackenberger, Hytrust #VMworld #GRC3386BUS Agenda GDPR Overview & Requirements IBM Secure
More informationThis Policy has been prepared with due regard to the General Data Protection Regulation (EU Regulation 2016/679) ( GDPR ).
PRIVACY POLICY Data Protection Policy 1. Introduction This Data Protection Policy (this Policy ) sets out how Brital Foods Limited ( we, us, our ) handle the Personal Data we Process in the course of our
More informationEmbedding GDPR into the SDLC. Sebastien Deleersnyder Siebe De Roovere
Embedding GDPR into the SDLC Sebastien Deleersnyder Siebe De Roovere Who is Who? Sebastien Deleersnyder 5 years developer experience 15+ years information security experience Application security consultant
More informationTIPS FOR FORGING A BETTER WORKING RELATIONSHIP BETWEEN COUNSEL AND IT TO IMPROVE CYBER-RESPONSE
TIPS FOR FORGING A BETTER WORKING RELATIONSHIP BETWEEN COUNSEL AND IT TO IMPROVE CYBER-RESPONSE Association of Corporate Counsel NYC Chapter 11/1 NYC BDO USA, LLP, a Delaware limited liability partnership,
More informationARE YOU READY FOR GDPR?
SQL Security Whitepaper ARE YOU READY FOR GDPR? BY BOB FULLAM AND STEPHEN STOUT Demonstrate Compliance with IDERA SQL Security Suite OVERVIEW The European Union s General Data Protection Regulation (GDPR)
More informationAdtech and GDPR What to consider when choosing your partner
Adtech and GDPR What to consider when choosing your partner 1 Agenda What to avoid and What to do Where is Adform on GDPR Posibilities for advertisers 2 This is about GDPR, not the unknown eprivacy update
More informationServiceNow Indicator Based Continuous Control Management
May 2018 ServiceNow Indicator Based Continuous Control Management Innovation in Automated Control Management INNOVATOR 2017 SOLUTIONPERSPECTIVE Governance, Risk Management & Compliance Insight 2018 GRC
More informationA practical guide to using ScheduleOnce in a GDPR compliant manner
A practical guide to using ScheduleOnce in a GDPR compliant manner Table of Contents Glossary 2 Background What does the GDPR mean for ScheduleOnce users? Lawful basis for processing Inbound scheduling
More informationNow on Now: How ServiceNow has transformed its own GRC processes
Now on Now: How ServiceNow has transformed its own GRC processes Increasing scalability, lowering risk, and slashing costs by $30,000 START 1 Introduction When your business is growing at 0% a year, it
More informationGeneral Data Protection Regulation (GDPR) FAQ
General Data Protection Regulation (GDPR) FAQ At Salesforce, trust is our #1 value and the protection of our customers data is paramount. We know that many organizations have questions about the GDPR and
More informationPutting security first for critical online brand assets. cscdigitalbrand.services
Putting security first for critical online brand assets cscdigitalbrand.services 2 As the most security conscious digital brand service provider, our clients trust us to take care of their businesses and
More informationIT SECURITY OFFICER. Department: Information Technology. Pay Range: Professional 18
Pierce County Classification Description IT SECURITY OFFICER Department: Information Technology Job Class #: 634900 Pay Range: Professional 18 FLSA: Exempt Represented: No Classification descriptions are
More informationCloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops.
George Gerchow, Sumo Logic Chief Information Security Officer Cloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops. Agenda Sumo Security
More informationReinvent Your 2013 Security Management Strategy
Reinvent Your 2013 Security Management Strategy Laurent Boutet 18 septembre 2013 Phone:+33 6 25 34 12 01 Email:laurent.boutet@skyboxsecurity.com www.skyboxsecurity.com What are Your Key Objectives for
More informationSCHOOL SUPPLIERS. What schools should be asking!
SCHOOL SUPPLIERS What schools should be asking! Page:1 School supplier compliance The General Data Protection Regulation (GDPR) comes into force on 25 May 2018 and will be applied into UK law via the updated
More informationHow to get the Enterprise to Understand the Value of Security
PART 1 of 2 Insight into Security Leader Success How to get the Enterprise to Understand the Value of Security A SEC Research Finding Intended Audience This presentation is intended for security leaders
More informationPutting It All Together:
Putting It All Together: The Interplay of Privacy & Security Regina Verde, MS, MBA, CHC Chief Corporate Compliance & Privacy Officer University of Virginia Health System 2017 ISPRO Conference October 24,
More informationEuropean Union Agency for Network and Information Security
Critical Information Infrastructure Protection in the EU Evangelos Ouzounis Head of Secure Infrastructure and Services Regional Cybersecurity Forum Sofia, Bulgaria 29 th November 2016 European Union Agency
More informationWITH ACTIVEWATCH EXPERT BACKED, DETECTION AND THREAT RESPONSE BENEFITS HOW THREAT MANAGER WORKS SOLUTION OVERVIEW:
SOLUTION OVERVIEW: ALERT LOGIC THREAT MANAGER WITH ACTIVEWATCH EXPERT BACKED, DETECTION AND THREAT RESPONSE Protecting your business assets and sensitive data requires regular vulnerability assessment,
More informationGDPR: Is it just another regulation or a great opportunity for operational excellence? Athens, February 2018
GDPR: Is it just another regulation or a great opportunity for operational excellence? Athens, February 2018 GDPR Roadmap Continuous Awareness Program Implement Privacy Solutions Intergrade Privacy into
More informationEffective Strategies for Managing Cybersecurity Risks
October 6, 2015 Effective Strategies for Managing Cybersecurity Risks Larry Hessney, CISA, PCI QSA, CIA 1 Everybody s Doing It! 2 Top 10 Cybersecurity Risks Storing, Processing or Transmitting Sensitive
More informationRecommendations on How to Tackle the D in GDPR. White Paper
Recommendations on How to Tackle the D in GDPR White Paper ABOUT INFORMATICA Digital transformation changes expectations: better service, faster delivery, with less cost. Businesses must transform to stay
More informationTHE NEW EU DATA PROTECTION REGULATION: WHAT IS IT AND WHAT DO WE NEED TO DO? KALLIOPI SPYRIDAKI CHIEF PRIVACY STRATEGIST, EUROPE
THE NEW EU DATA PROTECTION REGULATION: WHAT IS IT AND WHAT DO WE NEED TO DO? KALLIOPI SPYRIDAKI CHIEF PRIVACY STRATEGIST, EUROPE EU DATA PROTECTION REGULATION Kalliopi Spyridaki Chief Privacy Strategist,
More informationGDPR and the Privacy Shield
GDPR and the Privacy Shield Mark Prinsley Partner +44 20 3130 3900 mprinsley@mayerbrown.com Kendall Burman Counsel + 202 263 3210 kburman@mayerbrown.com Speakers Kendall Burman Counsel Washington DC Mark
More informationHIPAA Privacy, Security and Breach Notification
HIPAA Privacy, Security and Breach Notification HCCA East Central Regional Annual Conference October 2013 Disclaimer The information contained in this document is provided by KPMG LLP for general guidance
More informationNYDFS Cybersecurity Regulations
SPEAKERS NYDFS Cybersecurity Regulations Lisa J. Sotto Hunton & Williams LLP (212) 309-1223 lsotto@hunton.com www.huntonprivacyblog.com March 9, 2017 The Privacy Team at Hunton & Williams Over 30 privacy
More informationGDPR: A GUIDE TO READINESS
SATORI CONSULTING GDPR: A GUIDE TO READINESS The European Union (EU) is implementing the General Data Protection Regulation (GDPR) that takes effect May of 2018. Any businesses offering goods or services
More informationTop Five Privacy and Data Security Issues for Nonprofit Organizations
Top Five Privacy and Data Security Issues for Nonprofit Organizations Julia K. Tama, Esq. Jeffrey S. Tenenbaum, Esq. Association of Corporate Counsel Nonprofit Organizations Committee Legal Quick Hit MAY
More informationGDPR Workflow White Paper
White Paper The European Union is implementing new legislation with the objective of protecting personal data of citizens within the EU and giving them more control over how their data is used. Hefty fines
More informationCybersecurity and Data Protection Developments
Cybersecurity and Data Protection Developments Nathan Taylor March 8, 2017 NY2 786488 MORRISON & FOERSTER LLP 2017 mofo.com Regulatory Themes 2 A Developing Regulatory Environment 2016 2017 March CFPB
More informationFirst aid toolkit for the management of data breaches. Mary Deligianni Senior Associate 15 February 2018
First aid toolkit for the management of data breaches Mary Deligianni Senior Associate 15 February 2018 What is a personal data breach? Breach of security which leads to the accidental or unlawful destruction,
More informationGeneral Data Protection Regulation. May 25, 2018 DON T PANIC! PLAN!
General Data Protection Regulation May 25, 2018 DON T PANIC! PLAN! Protect the human behind the data record. On May 25, 2018 the General Data Protection Regulation (GDPR) is entering into force. It requires
More informationUniversity of Pittsburgh Security Assessment Questionnaire (v1.7)
Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.7) Directions and Instructions for completing this assessment The answers provided
More information2017 RIMS CYBER SURVEY
2017 RIMS CYBER SURVEY This report marks the third year that RIMS has surveyed its membership about cyber risks and transfer practices. This is, of course, a topic that only continues to captivate the
More informationThe HIPAA Omnibus Rule
The HIPAA Omnibus Rule What You Should Know and Do as Enforcement Begins Rebecca Fayed, Associate General Counsel and Privacy Officer Eric Banks, Information Security Officer 3 Biographies Rebecca C. Fayed
More informationHow icims Supports. Your Readiness for the European Union General Data Protection Regulation
How icims Supports Your Readiness for the European Union General Data Protection Regulation The GDPR is the EU s next generation of data protection law. Aiming to strengthen the security and protection
More information